The contents of these files are periodically appended to corresponding log
files, every 0.2 seconds by default.

The logger will try to detect the end of the boot process by looking for
specific processes. For example, when in runlevel 5 (multi-user graphical
mode), it will look for gdmgreeter, kdm_greet, etc.
As soon as one of these processes is found running, the logger will stop
collecting data, package the log files and store them to
/var/log/bootchart.tgz.

Optional Process Accounting

In most cases, the output from /proc/[PID]/stat files suffices
to recreate the process tree. It is possible however, that a short-lived
process will not get picked up by the logger. If that process also forks new
processes, the logger will lack dependency information for these
"orphaned" processes — meaning that they might get incorrectly
grouped by the chart renderer.

When truly accurate dependency information is required,
process accounting
may be utilized. If configured, the kernel will keep a log file with detailed
information about processes. BSD process accounting v3 includes information
about the process' PID and parent PID (PPID) — effectively enabling an
accurate reconstruction of the process tree.

To enable process accounting, the kernel needs to be configured to include
CONFIG_BSD_PROCESS_ACCT_V3, under:

The GNU accounting utilities (package psacct or
acct) also need to be installed. The boot logger will use the
accton command to enable process accounting; it will include the
accounting log in the tarball.

Visualization

The log tarball is later passed to the Java application for parsing
and rendering the data. The CPU and disk statistics are used to render
stacked area and line charts. The process information is used to create a
Gantt chart showing process dependency, states and CPU usage.

A typical boot sequence consists of several hundred processes.
Since it is difficult to visualize such amount of data in a comprehensible
way, tree pruning is utilized. Idle background processes and short-lived
processes are removed. Similar processes running in parallel are also merged
together.

Finally, the performance and dependency charts are renderer as a single
image in either PNG, SVG or EPS format.